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O . Abstract 

, We introduce a new model for studying quantum data structure problems — the 

quantum cell probe model. We prove a lower bound for the static predecessor problem 
^Sl ' in the address-only version of this model where we allow quantum parallelism only 

. over the 'address lines' of the queries. The address-only quantum cell probe model 

^ I subsumes the classical cell probe model, and many quantum query algorithms like 

Grover's algorithm fall into this framework. Our lower bound improves the previous 
■ known lower bound for the predecessor problem in the classical cell probe model with 

randomised query schemes, and matches the classical deterministic upper bound of 
Beame and Fich |BF99|. Beame and Fich [BF9£] have also proved a matching lower 



bound for the predecessor problem, but only in the classical deterministic setting. 
Oh. Our lower bound has the advantage that it holds for the more general quantum 

I model, and also, its proof is substantially simpler than that of Beame and Fich. 

■ We prove our lower bound by obtaining a round elimination lemma for quantum 

^ . communication complexity. A similar lemma was proved by Miltersen, Nisan, Safra 



and Wigderson [MNSW98| for classical communication complexity, but it was not 
strong enough to prove a lower bound matching the upper bound of Beame and 
^ . Fich. Our quantum round elimination lemma also allows us to prove rounds versus 

^ I communication tradeoffs for some quantum communication complexity problems like 

the 'greater-than' problem. 

We also study the static membership problem in the quantum cell probe model. 



Generalising a result of Yao |Yao81], we show that if the storage scheme is implicit, 
that is it can only store members of the subset and 'pointers', then any quantum 
query scheme must make il(logn) probes. 
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1 Introduction 



A static data structure problem consists of a set of data D, a set of queries Q, a set of 
answers A, and a function f : D x Q ^ A. The aim is to store the data efficiently and 
succinctly, so that any query can be answered with only a few probes to the data structure. 
In a seminal paper ||Yao81|| , Yao introduced the (classical) cell probe model for studying 
static data structure problems (in the classical setting). Thereafter, this model has been 
used extensively to prove (classical) upper and lower bounds for several data structure 
problems (see e.g. ||1^'KS84| , |M1NSW98| , [BF99| , [BMKVOO|| ). A classical {s,w,t) cell probe 
scheme for / has two components: a storage scheme and a query scheme. Given the data 
d E D to he stored, the storage scheme stores it as a table of s cells, each cell w bits 
long, w is called the word size of the scheme. The query scheme has to answer queries. 
Given a query g G Q, the query scheme computes the answer f{d,q) to that query by 
making at most t probes to the stored table T^, where each probe reads one cell at a time. 
The storage scheme is deterministic whereas the query scheme can be deterministic or 
randomised. The goal is to study tradeoffs between s, t and w. For an overview of results 
in this model, see the survey by Miltersen |[Mil99| . 

In this paper, we study static data structure problems, such as the static member- 
ship problem and the static predecessor problem, when the query algorithm is allowed to 
query the table using a quantum superposition. We formalise this by defining the quan- 
tum cell probe model similar to the quantum bit probe model of Radhakrishnan, Sen and 
Venkatesh | JRS V OCI| | . Informally, in the quantum cell probe model, the storage scheme is 
classical deterministic as before and stores the data ci G -D as a table of cells T^, however, 
the query scheme is quantum and can query the table using a quantum superposition. 
We show a lower bound for the predecessor problem in a restricted version of this model, 
which we call the address-only quantum cell probe model. In the predecessor problem, the 
storage scheme has to store a subset S of size at most n from the universe [m], such that 
given any query element x G [m], one can quickly find the predecessor of x in S. 

Result 1 (Lower bound for predecessor, informal statement) Suppose 
we have an address-only quantum cell probe solution with constant probability 
of error for the static predecessor problem, where the universe size is m and the 
subset size is at most n, using rP'^^^ cells of storage with word size (logm)'^'^^) 
bits. Then the number of queries is at least Vl ( . ^°g'°g™ ) as a function of m, 

■' ^ \ log log log m J ■> J J 



and at least Vt i^'gipg^ j (^s a function of n. 

We then consider the static membership problem. Here one has to answer membership 
queries instead of predecessor queries. Yao |[Yao81|| showed that if the universe is large 
enough, any classical cell probe solution with an implicit deterministic storage scheme 
and a deterministic query scheme for the static membership problem must make VL{\ogn) 
probes to the table in the worst case. An implicit storage scheme either stores a 'pointer 
value' (viz. a value which is not an element of the universe) or an element of 5* in a cell. 
In particular, it is not allowed to store an element of the universe which is not a member 
of S. We generalise Yao's result to the quantum setting. 
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Result 2 (Lower bound for membership, informal statement) Suppose 
we have a quantum cell probe solution with an implicit storage scheme for the 
static membership problem. Then, if the universe is large enough compared to 
the number of cells of storage, the size of the universe of 'pointers ' and the size 
of the stored subset, the query algorithm must make f2(logn) probes, even if we 
allow constant probability of error. 



Remarks: 

1. Our address- only quantum cell probe model subsumes the classical cell probe model 
with randomised query schemes. Hence, our lower bound for the static predecessor problem 
also holds in this setting. This improves the previous lower bound f2(v^log logm) as a 
function of m and Q(\og^^^ n) as a function of n for this setting, shown by Miltersen, 
Nisan, Safra and Wigderson [[MNSW98|] . Beame and Fich ||BF99|| have shown an upper 
bound matching our lower bound up to constant factors, which uses n"^^^^ cells of storage 
of word size O(logm) bits. In fact, both the storage and the query schemes are classical 
deterministic in Beame and Fich's solution. In their paper, Beame and Fich ||BI''99|| also 



show a lower bound of t 



log log m 



as a function of m for 
and a lower bound of t 



~ ^ (\/log logn) 



as a 



^ log log log m I 

classical deterministic cell probe schemes, ^.^^^ ^ uwuii^^ o — , ^, , , 

function of n for {logm)^'^^\t) classical deterministic cell probe schemes. But their 

lower bound proof breaks down if the query scheme is randomised. Our result thus shows 
that the upper bound scheme of Beame and Fich is optimal all the way up to the bounded 
error address-only quantum cell probe model. Also, our proof is substantially simpler than 
that of Beame and Fich. 

2. It is known that querying in superposition gives a speed up over classical algorithms 
for certain data retrieval problems, the most notable one being Grover's algorithm ||Gro96 | 
for searching an unordered list of n elements using 0{y/n) quantum queries. The power 
of quantum querying for data structure problems was studied in the context of static 
membership by Radhakrishnan, Sen and Venkatesh | RSVOO |. In their paper, they worked 
in the quantum bit probe model, which is our quantum cell probe model where the word 
size is just one bit. They showed, roughly speaking, that quantum querying does not give 
much advantage over classical schemes for the set membership problem. Our result above 
seems to suggest that quantum search is perhaps not more powerful than classical search 
for the predecessor problem as well. 

3. In the next section, we formally describe the "address-only" restrictions we impose on 
the query algorithm. Informally, they amount to this: we allow quantum parallelism over 
the 'address lines' going into the table, but we have a fixed quantum state on the 'data 
lines'. This restriction on quantum querying does not make the model trivial. In fact, 
many non-trivial quantum search algorithms, such as Grover's algorithm ||Gro96|| , Farhi 
et a/.'s algorithm ||FGGS99l , and H0yer et al.'s algorithm ||HNS01|| , already satisfy these 
restrictions. 

4. For the static membership problem, Fredman, Komlos and Szemeredi 



have 

shown a classical deterministic cell probe solution where the storage scheme uses 0{n) 
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cells of word size O(logm) bits, and the query scheme makes only a constant number of 
probes. In this solution, the storage scheme may store elements of the universe in the table 
which are not members of the subset to be stored. Hence the restriction that the storage 
scheme be implicit is necessary for any such result. We note that implicit storage schemes 
include many of the standard storage schemes like sorted array, hash table, search trees 
etc. 



1.1 Techniques 

The lower bounds for the static membership problem shown in the quantum bit probe 
model by Radhakrishnan et al. |[RSVOO| | relied on linear algebraic techniques. Unfortu- 



nately, these techniques appear to be powerless in the quantum cell probe model. In fact, to 
show the lower bound above for the static predecessor problem, we use a connection between 
quantum data structure problems and two-party quantum communication complexity, sim- 
ilar to what was used by Miltersen, Nisan, Safra and Wigderson |[MNSW9^] , and Beame 



and Fich |[BI''99| for showing their (classical) lower bounds. Miltersen et al. | [MMSW9B | 



proved a technical lemma in classical communication complexity called the round elimina- 
tion lemma and derived from it lower bounds for various static data structure problems, 
including the predecessor problem. But their round elimination lemma was not strong 
enough to prove a lower bound matching the upper bound of Beame and Fich. In this 
paper we prove a stronger (!) round elimination lemma for the quantum communica- 
tion complexity model, which we then use to show a quantum lower bound for the static 
predecessor problem matching Beame and Fich's upper bound. Our quantum round elimi- 
nation lemma is proved using quantum information theoretic techniques. Inspired by these 
techniques, we prove a still stronger round elimination lemma in classical communication 
complexity. 

We now give an informal description of the round elimination lemma. Suppose / : 
X F — G is a function. In the communication game corresponding to /, Alice gets a 
string X & E, Bob gets a string y E F, and they have to communicate and compute /(x, y). 
In the communication game /^"■', Alice gets n strings xi, . . . ,x„ G -E; Bob gets an integer 
2 G [n], a string y E F, and a copy of the strings Xi, . . . , Their aim is to communicate 
and compute /(xj, y). Suppose a quantum protocol for /"^"^ is given where Alice starts, and 
her first message is much smaller than n qubits. Intuitively, it would seem that since Alice 
does not know i, the first round of communication cannot give much information about Xi, 
and thus, would not be very useful to Bob. Hence it should be possible to eliminate the 
first round of communication, giving a quantum protocol for computing /(xj, y) where Bob 
starts, with one less round of communication, and having the same message complexity and 
similar error probability. The round elimination lemma justifies this intuition. Moreover, 
we show that this is true even if Bob also gets copies of xi, . . . , Xi_i, a case which is needed 
in many applications. 

Result 3 (Round elimination lemma, informal statement) A t round 
quantum protocol for f'^'^'^^ with Alice starting, where the first message of Alice is 
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much smaller than n qubits, gives us at — 1 round quantum protocol for f where 
Bob starts, with the same message complexity and similar error probability. An 
analogous statement holds for classical randomised protocols. 

Round reduction arguments have been given earlier in quantum communication com- 
plexity, most notably by Klauck, Nayak, Ta-Shma and Zuckerman ||KM'1'Z0T |. However, for 



technical reasons, the previous arguments do not go far enough to prove lower bounds for 
the communication games arising from data structure problems like the predecessor prob- 
lem. We need a technical quantum version of the round elimination lemma of Miltersen et 
al. [ MNSW9^ , to prove the desired quantum lower bounds. 



The round elimination lemma also has applications to other communication complexity 
problems, which might be interesting on their own. For example, it can be used to prove 
rounds versus communication tradeoffs for the 'greater-than' problem. In the 'greater- 
than' problem GT„, Alice is given x G {0, 1}", Bob is given y G {0, 1}", and they have to 
communicate and decide whether x > y (treating x,y as integers). 

Result 4 The t round bounded error quantum (classical randomised) commu- 
nication complexity of GTn is Vt{n^f*t^^) (Vl{n^^^t^'^)). 

There exists a bounded error classical randomised protocol for GTn using t rounds of com- 
munication and having a complexity of 0{n}/*\ogn). Hence, for a constant number of 
rounds, our quantum lower bound matches the classical upper bound to within logarith- 
mic factors. For one round quantum protocols, our result implies an Vl{n) lower bound for 
GTn (which is optimal to within constant factors), improving upon the previous VL{n/ logn) 



lower bound of Klauck [ [KlaOO|| . No rounds versus communication tradeoff for this prob- 
lem, for more than one round, was known earlier in the quantum setting. For classical 
randomised protocols, Miltersen et al. ||MNSW98[] showed a lower bound of VL{n^/*2~^^^'>) 



using their round elimination lemma. If the number of rounds is unbounded, then there 
is a classical randomised protocol for GT„ using 0(log?T,) rounds of communication and 
having a complexity of Oilogn) ||Nis93|| . An VL{\ogn) lower bound for the bounded error 



quantum communication complexity of GTn (irrespective of the number of rounds) follows 
from Kremer's result ||Kre95|| that the bounded error quantum communication complexity 



of a function is lower bounded (up to constant factors) by the logarithm of the one round 
(classical) deterministic communication complexity. 



1.2 Organisation of the paper 

Section |2| contains definitions of various terms that will be used throughout the paper. In 
Section ^, we discuss some lemmas that will be needed in the proofs of the main theorems. 
Section ^contains a proof of the quantum and classical round elimination lemmas. Proofs of 
some lemmas required to prove the round elimination lemma proper have been relegated 
to the appendix. In Section |^, we apply our round elimination lemma to prove lower 
bounds for the query complexity of the static predecessor problem and the communication 
complexity of the 'greater-than' problem. Section ^ contains a proof of our lower bound 
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for implicit storage quantum cell probe schemes for the static membership problem. We 
conclude with a few remarks and some open problems in Section |^. 



2 Definitions 

In this section we define some of the terms which we will be using in this paper. 
2.1 The quantum cell probe model 

A quantum {s,w,t) cell probe scheme for a static data structure problem f : D x Q A 
has two components: a classical deterministic storage scheme that stores the data d & D in 
a table using s cells each containing w bits, and a quantum query scheme that answers 
queries by 'quantumly probing a cell at a time' t times. Formally speaking, the table is 
made available to the query algorithm in the form of an oracle unitary transform 0^- To 
define Od formally, we represent the basis states of the query algorithm as \j,b,z), where 
j G [s — 1] is a binary string of length log s, 6 is a binary string of length w, and 2; is a 
binary string of some fixed length. Here, j denotes the address of a cell in the table T^, b 
denotes the qubits which will hold the contents of a cell and z stands for the rest of the 
qubits ('work qubits') in the query algorithm. Od maps \j,b,z) to |j, 6 © iTd)j,z), where 
(Td)j is a bit string of length w and denotes the contents of the jth cell in T^. A quantum 
query scheme with t probes is just a sequence of unitary transformations 

Uo ^ Od ^ Ui ^ Od ^ . . .Ut-i ^ Od ^ Ut 

where Uj's are arbitrary unitary transformations that do not depend on d (representing the 
internal computations of the query algorithm). For a query q ^ Q, the computation starts 
in a computational basis state Iq') |0), where we assume that the ancilla qubits are initially in 
the basis state |0). Then we apply in succession, the operators Uq, Od, Ui, . . . , Ut-i, Od, Ut, 
and measure the final state. The answer consists of the values on some of the output wires 
of the circuit. We say that the scheme has worst case error probability less than e if the 
answer is equal to f{d,q), for every {d,q) E D x Q, with probability greater than 1 — e. 
The term 'bounded error quantum scheme' means that e = 1/3. 

We now formally define the address-only quantum cell probe model. Here the storage 
scheme is as in the general model, but the query scheme is restricted to be 'address-only'. 
This means that the state vector before a query to the oracle Od is always a tensor product 
of a state vector on the address and work qubits (the {j,z) part in {j,b,z) above), and 
a state vector on the data qubits (the b part in {j,b,z) above). The state vector on the 
data qubits before a query to the oracle Od is independent of the query element q and 
the data d but can vary with the probe number. Intuitively, we are only making use of 
quantum parallelism over the address lines of a query. This mode of querying a table 
subsumes classical querying, and also many non-trivial quantum algorithms like Grover's 
algorithm [|Gro96|| , Farhi et al.^s algorithm |[FGGS99| , H0yer et a/.'s algorithm ||HNS01 



etc. satisfy the 'address-only' condition. For classical querying, the state vector on the 
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data qubits is |0), independent of the probe number. For Grover and Farhi et al, the state 
vector on the data qubit is (|0) — |l))/-\/2, independent of the probe number. For H0yer et 
al., the state vector on the data qubit is |0) for some probe numbers, and (|0) — \l))/^/2 
for the other probe numbers. 



2.2 Quantum communication protocols 



We consider two party quantum communication protocols as defined by Yao |[Yao93|| . Let 



E, F, G be arbitrary finite sets and f : E x F ^ G he a. function. There are two players 
Alice and Bob, who hold qubits. When the communication game starts, Alice holds |a;) 
where x & E together with some ancilla qubits in the state |0), and Bob holds \y) where 
y E F together with some ancilla qubits in the state |0). Thus the qubits of Alice and 
Bob are initially in computational basis states, and the initial superposition is simply 
\x)A\0)A\y)B\0)B- Here the subscripts denote the ownership of the qubits by Alice and 
Bob. The players take turns to communicate to compute f{x,y). Suppose it is Alice's 
turn. Alice can make an arbitrary unitary transformation on her qubits and then send one 
or more qubits to Bob. Sending qubits does not change the overall superposition, but rather 
changes the ownership of the qubits, allowing Bob to apply his next unitary transformation 
on his original qubits plus the newly received qubits. At the end of the protocol, the last 
recipient of qubits performs a measurement on the qubits in her possession to output an 
answer. We say a quantum protocol computes / with e-error in the worst case, if for any 
input {x,y) & E x F, the probability that the protocol outputs the correct result f{x,y) 
is greater than 1 — e. The term 'bounded error quantum protocol' means that e = 1/3. 

We require that Alice and Bob make a secure copy of their inputs before beginning the 
protocol. This is possible since the inputs to Alice and Bob are in computational basis 
states. Thus, without loss of generality, the input qubits of Alice and Bob are never sent 
as messages, their state remains unchanged throughout the protocol, and they are never 
measured i.e. some work qubits are measured to determine the result of the protocol. We 
call such protocols secure. We will assume henceforth that all our protocols are secure. 

We now define the concept of a safe quantum protocol, which will be used in the 
statement of the quantum round elimination lemma. 

Definition 1 (Safe quantum protocol) A [t, c,li, . . . , If]"^ ([t, c,li, . . . , k]^ ) safe quan- 
tum protocol is a secure quantum protocol where Alice (Bob) starts the communication, the 
first message is li + c qubits long, the ith message, for i > 2, is li qubits long, and the 
communication goes on for t rounds. We think of the first message as having two parts: 
the 'main part' which is li qubits long, and the 'safe overhead part' which is c qubits long. 
The density matrix of the 'safe overhead' is independent of the inputs to Alice and Bob. 

Later on in the paper, we also use the notation (t,c, a, 6)"^ {(t,c,a,b)^) to denote a 
[t,c,li, . . . ,lt]^ {[t,c,li, . . . ,lt]^) safe quantum protocol, where the per round message 
lengths of Alice and Bob are a and b qubits respectively i.e. if Alice (Bob) starts, k = a 
for i odd and k = b for i even (/j = b for i odd and k = a for i even). 
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Remark: The concept of a safe quantum protocol may look strange at first. The reason 
we need to define it, intuitively speaking, is as follows. The communication games arising 
from data structure problems often have an asymmetry between the message lengths of 
Alice and Bob. This asymmetry is crucial to prove lower bounds on the number of rounds 
of communication. In the previous quantum round reduction arguments (e.g. those of 



Klauck et al. |[KNTZ01[] ), the complexity of the first message in the protocol increases 
quickly as the number of rounds is reduced and the asymmetry gets lost. This leads to 
a problem where the first message soon gets big enough to potentially convey substantial 
information about the input of one player to the other, destroying any hope of proving 
strong lower bounds on the number of rounds. The concept of a safe protocol allows us 
to get around this problem. We show through a careful quantum information theoretic 
analysis of the round reduction process, that in a safe protocol, though the complexity of 
the first message increases a lot, this increase is confined to the safe overhead and so, the 
information content does not increase much. This is the key property which allows us to 
prove a round elimination lemma for safe quantum protocols. 

In this paper we will deal with quantum protocols with public coins. Intuitively, a 
public coin quantum protocol is a probability distribution over finitely many {coinless) 
quantum protocols. We shall henceforth call the standard definition of a quantum protocol 
as coinless. Our definition is similar to the classical scenario, where a randomised protocol 
with public coins is a probability distribution over finitely many deterministic protocols. 
We note however, that our definition of a public coin quantum protocol is not the same 
as that of a quantum protocol with prior entanglement, which has been studied previously 
(see e.g. |CvDNT5B|). Our definition is weaker, in that it does not allow the unitary 
transformations of Alice and Bob to alter the 'public coin'. 

Definition 2 (Public coin quantum protocol) In a quantum protocol with a public 
coin, there is, before the start of the protocol, a quantum state called a public coin, of 
the form J2cVPc\c)a\c)b, where the subscripts denote ownership of qubits by Alice and 
Bob, pc are finitely many non-negative real numbers and J2cPc = 1- Alice and Bob make 
(entangled) copies of their respective halves of the public coin using CNOT gates before 
commencing the protocol. The unitary transformations of Alice and Bob during the proto- 
col do not touch the public coin. The public coin is never measured, nor is it ever sent as 
a message. 

Hence, one can think of the public coin quantum protocol to be a probability distribution, 
with probability p^, over finitely many coinless quantum protocols indexed by the coin 
basis states |c). A safe public coin quantum protocol is similarly defined as a probability 
distribution over finitely many safe coinless quantum protocols. 

Remarks: 

1. We need to define public coin quantum protocols in order to make use of the harder 



direction of Yao's minimax lemma [Yao77 . The minimax lemma is the main tool which 



allows us to convert 'average case' round reduction arguments to 'worst case' arguments. 
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We need 'worst case' round reduction arguments in proving lower bounds for the rounds 
complexity of communication games arising from data structure problems. This is because 
many of these lower bound proofs use some notion of "self-reducibility" , arising from the 
original data structure problem, which fails to hold in the 'average case' but holds for 
the 'worst case'. The quantum round reduction arguments of Klauck et al. ||KJNTZOl | 
are 'average case' arguments, and this is one of the reasons why they do not suffice to 
prove lower bounds for the rounds complexity of communication games arising from data 
structure problems. 

2. Parallel repetitions of protocols, as well as constructing new protocols from old ones 
using both the directions of Yao's minimax lemma, preserve the "safety" property. 

For an input (x, y) E E x F, we define the error e^y of the protocol P on (x, y), to be 
the probability that the result of P on input {x,y) is not equal to f{x,y). For a protocol 
P, given a probability distribution D on E x F, we define the average error of P with 
respect to D as the expectation over D of the error of P on inputs {x, y) E E x F. We 
define to be worst case error of P on inputs (x, y) E E x F. 



3 Preliminaries 

In this section we state some facts which will be useful in what follows. 



3.1 Yao's minimax lemma 

For completeness, we state Yao's minimax lemma HYao77|| for safe quantum protocols in 
the (slightly more general) flavour that will be required by us. The proof of this flavour of 
the lemma is very similar to the standard proof, using the von Neumann minimax theorem. 



Lemma 1 (Yao's minimax lemma) Consider [t,c,li, . . . , It]"^ safe quantum protocols P 
for a function f : E x F ^ G. Let D denote a probability distribution on the inputs 
{x,y) e E X F. Then 

inf = sup inf e£ = sup inf 

P: public coin d P: coinless d P: public coin 

Analogous properties hold for classical protocols too. 

3.2 Quantum cell probe complexity and communication 

In this subsection, we describe the connection between the quantum cell probe complexity 
of a static data structure problem and the quantum communication complexity of an 
associated communication game. Let f : D x Q ^ Ahe a. static data structure problem. 
Consider a two-party communication problem where Alice is given a query q E Q, Bob is 
given data d E D, and they have to communicate and find out the answer f{d,q). We 
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have the following lemma, which is a quantum analogue of a lemma of Miltersen |[Mil94 
relating cell probe complexity to communication complexity in the classical setting. 



Lemma 2 Suppose we have a quantum {s,w,t) cell probe solution to the static data struc- 
ture problem f . Then we have a (2t,0,logs + w,logs + w)^ safe coinless quantum protocol 
for the corresponding communication problem. If the query scheme is address- only, we can 
get a (2i:, 0, logs, log s -\- w)"^ safe coinless quantum protocol. The error probability of the 
communication protocol is the same as that of the cell probe scheme. 

Proof: Given a quantum (s, w, t) cell probe solution to the static data structure problem /, 
we can get a (2t, 0, log s+w, log s-\-w)^ safe coinless quantum protocol for the corresponding 
communication problem by just simulating the cell probe solution. If in addition, the query 
scheme is address-only, the messages from Alice to Bob need consist only of the 'address' 
part. This can be seen as follows. Let the state vector of the data qubits before the zth 
query he \9i). \9i) is independent of the query element and the stored data. Bob keeps t 
special ancilla registers in states \6i), 1 < i < t at the start of the protocol P. These special 
ancilla registers are in tensor with the rest of the qubits of Alice and Bob at the start of 
P. Protocol P simulates the cell probe solution, but with the following modification. To 
simulate the ith query of the cell probe solution, Alice prepares her 'address' and 'data' 
qubits as in the query scheme, but sends the 'address' qubits only. Bob treats those 
'address' qubits together with \9i) in the ith special ancilla register as Alice's query, and 
performs the oracle table transformation on them. He then sends these qubits (both the 
'address' as well as the zth special register qubits) to Alice. Alice exchanges the contents 
of the ith special register with her 'data' qubits (i.e. exchanges the basis states), and 
proceeds with the simulation of the query scheme. This gives us a (2t, 0, log s, log s + w)"^ 
safe coinless quantum protocol with the same error probability as that of the cell probe 
query scheme. ■ 
In many natural data structure problems logs is much smaller than w and thus, in 
the address-only quantum case, we get a {2t, 0, logs, 0(w))^ safe protocol. In the classical 
setting, one gets a (2t, 0, log s, w)^ protocol. This asymmetry in message lengths is crucial 
in proving non-trivial lower bounds on t. The concept of a safe quantum protocol helps us 
in exploiting this asymmetry. 



3.3 Background from quantum information theory 

In this subsection, we discuss some basic facts from quantum information theory that will 
be used in the proof of the round elimination lemma. We follow the notation of Klauck, 



Nayak, Ta-Shma and Zuckerman's paper [KNTZOl]. For a good account of quantum 



information theory, see the book by Nielsen and Chuang 

If y4 is a quantum system with density matrix p, then S{A) = S{p) = — Tr plogp is 
the von Neumann entropy of A. If A, B are two disjoint quantum systems, their mutual 
information is defined as I {A : B) = S{A) + S{B) - S{AB). We now state some properties 
about von Neumann entropy and mutual information which will be useful later. The 
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proofs follow easily from the definitions, using basic properties of von Neumann entropy 
like subadditivity and triangle inequality (see e.g. ||NCOO| , Chapter 11]). 



Lemma 3 Suppose A, B, C are disjoint quantum systems. Then 

I{A : BC) = I{A : B) + I{AB : C) - I{B : C) 

0<I{A:B)< 2S{A) 
If the Hilbert space of A has dimension d, then 

< S{A) < \ogd 

Suppose X, Q are disjoint quantum systems with finite dimensional Hilbert spaces Ti, /C 
respectively. For every computational basis state \x) e suppose is a density matrix in 
/C. Suppose the density matrix of (X, Q) is Y.xVxlx) {x\ ® a^, where Px > ^ and Y.xVx = 1- 
Thus X is in a mixed state {p^;? 1 2;)}, and we shall say that X is a classical random variable 
and that Q is a quantum encoding \x) ^— of X. Define a = Y.xPx<^x- is the reduced 
density matrix of Q, and we shall say that a is the the density matrix of the average 
encoding. Then, S{XQ) = S{X) + J2xPxS{ax), and hence, /(X : Q) = S{a) — J2xPxS{o^x)■ 
Let X, Y, Q be disjoint quantum systems with finite dimensional Hilbert spaces 7i, /C, C 
respectively. Let x E H, y E IC he computational basis vectors. For every \x)\y) G 7i ® /C, 
suppose axy is a density matrix in C Let Z refer to the quantum system (X, Y). Suppose 
(X, Y, Z) has density matrix Y.x,yPxy\x){x\ ®\y){y\® (Jxy, where pxy > and 'Ex,yPxy = 1- 
Thus, X and Y are classical random variables, and Z = XY is in a mixed state {pxy, \x) \y)}- 
Q is a quantum encoding \xy) ^ (r.j.y of Z. Define to be the (conditional) probability 
that Y = y given that X = x. \y) ^ Uxy can be thought of as a quantum encoding 
of Y given that X = x. The joint density matrix of {Y,Q^) is Hy'iy\y){y \ ® o'xy We let 
I{{Y : Q)\X = x) denote the mutual information of this encoding. 
We now prove the following propositions. 

Proposition 1 Let Mi, M2 he disjoint finite dimensional quantum systems. Suppose M = 
(Mi,M2) is a quantum encoding \x) 1-^ (x^ of a classical random variable X. Suppose the 
density matrix of M2 is independent of X i.e. TrM^ cTx is the same for all x. Let Mi be 
supported on a qubits. Then, I{X : M) < 2a. 

Proof: By Lemmag J(X : M) = /(X : M1M2) = /(X : M2)+/(XM2 : Mi)-/(M2 : Mi). 
But since the density matrix of M2 is independent of X, /(X : M2) = 0. Hence, by again 
using Lemma |, we get that /(X : M) < /(XM2 : Mi) < 2S'(Mi) < 2a. ■ 

Remarks: 

1. This proposition is the key observation allowing us to "ignore" the size of the "safe" 
overhead M2 in the round elimination lemma. It will be very useful in the applications of 
the round elimination lemma, where the complexity of the first message in the protocol 
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increases quickly, but the blow up is confined to the "safe" overhead. Earlier round re- 
duction arguments were unable to handle this large blow up in the complexity of the first 
message. 

2. In the above proposition, if M is a classical encoding of X (i.e. an encoding \x) h-^ ax-, 
where ax is a density matrix of a mixture of computational basis vectors), we get the 
improved inequality I{X : M) < a. 

The next proposition has been observed by Klauck et al. ||KNTZ01|] . 

Proposition 2 Suppose M is a quantum encoding of a classical random variable X. Sup- 
pose X = X1X2 . . -Xn, where the Xi are classical independent random variables. Then, 
J(Xi . . . X„ : M) = EILi I{X^ : MX^ . . . X,„i) . 

Proof: The proof is by induction on n, using Lemma |^ repeatedly. We also use the fact 
that I{Xi : Xj+i . . = for 1 < i < n, since Xi, . . . ,X„ are independent classical 
random variables. ■ 

Proposition 3 Let X, Y be classical random variables and M be a quantum encoding of 
(X,F). Then, liY : MX) = /(X : Y) + Ex[I{iY : M)\X = x)]. 

Proof: Let (Jxy be the density matrix of M when X, F = x, y. Let Px be the (marginal) 
probability that X = x and the (conditional) probability that Y = y given X = x. 

Define ax = J^yQy'^xy We now have 

I{Y : MX) = S{Y) + S{MX) - S{MXY) 

= SiY) + S{X) + Y.P-S{ax) - {S{XY) + Y.pxqlS{axy)) 



x,y 



I{X : Y) + J2p,,(Siax) - E QySiaxy)) 

X y 

I{X:Y) + J2pxI{{Y:M)\X = x) 

X 

IiX:Y) + Ex[IiiY:M)\X = x)] 



4 The round elimination lemmas 

In this section we prove our round elimination lemmas for safe public coin quantum proto- 
cols and public coin classical randomised protocols. Since a public coin quantum protocol 
can be converted to a coinless quantum protocol at the expense of an additional "safe" 
overhead in the first message, we also get a similar round elimination lemma for coinless 
protocols. We can decrease the overhead to logarithmic in the total bit size of the inputs 
by a technique similar to the public to private coins conversion for classical randomised 
protocols pew91|| . But since the statement of the round elimination lemma is cleanest 



for safe public coin quantum protocols, we give it below for such protocols only. Similar 
remarks apply to the classical setting. 
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4.1 The quantum round elimination lemma 

In this subsection we prove our round elimination lemma for safe public coin quantum 
protocols. We first state the following round reduction lemma, which can be proved in a 
manner similar to the proof of Lemma 4.4 in Klauck et al. ||KNTZ01[] , but with a careful 



accounting of "safe" overheads in the messages communicated by Alice and Bob. Intuitively 
speaking, the lemma says that if the first message of Alice carries little information about 
her input, under some probability distribution on inputs, then it can be eliminated, giving 
rise to a protocol where Bob starts, with one less round of communication, and the same 
message complexity and similar error probability, with respect to the same probability 
distribution on inputs. We observe, in the lemma below, that though there is a overhead 
of Zi + c qubits on the first message of Bob, it is a "safe" overhead. 

Lemma 4 Suppose f : E x F ^ G is a function. Let D be a probability distribution on 
E X F, and P be a [t,c,li, . . . , Z^]^ safe coinless quantum protocol for f . Let X stand for 
the classical random variable denoting Alice's input (under distribution D), M be the first 
message of Alice in the protocol P , and I{X : M) denote the mutual information between 
X and M under distribution D. Then there exists a [t — l,c + li,l2, ■ ■ ■ ,k]^ safe coinless 
quantum protocol Q for f , such that 

eg<e£ + ((21n2)/(X:M))^/^ 

A proof of this lemma can be found in the appendix. 

We can now prove the quantum round elimination lemma (for the communication game 

Lemma 5 (Quantum round elimination lemma) Suppose f : E x F ^ G is a func- 
tion. Suppose the communication game /'-'"'•* has a [t, c, /i, . . . , /j]"^ safe public coin quantum 
protocol with worst case error less than 5. Then there is a [t — \, c + li,l2, ■ ■ ■ ,lt\^ safe 



public coin quantum protocol for f with worst case error less than e = 5 + (4/iln2/n 



>l/4 



Proof: Suppose the given protocol for /*^") has worst case error 6 < 6. Define e = 
6 + (4/i In To prove the quantum round elimination lemma it suffices to give, by 

the harder direction of the minimax lemma (Lemma [1|), for any probability distribution 
D on E X F, a [t — l,c + li,l2, ■ ■ ■ , h]^ safe public coin quantum protocol P for / with 
average distributional error < e < e. To this end, we will first construct a probability 
distribution D* on E"" x [n] x F as follows. Choose i G [n] uniformly at random. Choose 
independently, for each j G [n], {xj,yj) G E x F according to distribution D. Set y = Hi 
and throw away yj,j ^ i. By the easier direction of the minimax lemma (Lemma |l]), we 
get a [t, c, /i, . . . , k]^ safe coinless quantum protocol P* for /*^") with distributional error, 
^D* < 5 < 5- In P*, Ahce gets xi, . . . , x„. Bob gets i, y and xi, . . . , Xi-i. We shall construct 
the desired protocol P from the protocol P*. 

Let M be the first message of Alice in P*. By the definition of a safe protocol, M has 
two parts: Mi /i qubits long, and the "safe" overhead M2, c qubits long. Let the input 
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to Alice be denoted by the classical random variable X = X1X2 . . . X„ where Xi is the 
classical random variable corresponding to the ith input to Alice. Let the classical random 
variable Y denote the input y of Bob. Define ^D**;i;xi,...,Xi_i to be the average error of P* 
under distribution D* when i is fixed and Xi, . . . , are fixed to xi, . . . , Xi-i. Using 
Propositions |I], 0, | and the fact that under distribution D*, Xi, . . . ,Xn are independent 
classical random variables, we get that 



> 

n — n 



2h ^ I{X:M) 

n 

E,[I{Xr.MXu...,X,^,)] (1) 
E,^x[I{{Xi : M)\X^, ...,X,_, = Xi, . . . 



Also 



~6 > e'^: = E,._ 



^D* ;i;xi ,...,Xi-i 



(2) 



The expectations above are under distribution D*. 

For any i E [n], Xi, . . . ,Xi-i G E, define the [t,c,li, . . . Jt]"^ safe coinless quantum 
protocol P/.^^ for the function / as follows. Alice is given x E E and Bob is given 

y E F. Bob sets i to the given value, and both Alice and Bob set Xi, . . . to the 

values xi, . . . ,Xi-i. Alice puts an independent copy of a pure state \ip) (defined below) 
for each of the inputs Xi^i, . . . ,X„. She sets Xi = x and Bob sets Y = y. Then they 
run protocol P* on these inputs. Here = J2x£E y/Px\^) ^ where is the (marginal) 
probability of x under distribution D. Since P* is a safe coinless quantum protocol, so is 
-P/xi Because P* is a secure protocol, the probability that P/.^.^ makes an error 

for an input {x,y), ex'y^' " "''^'^, is the average probability of error of P* under distribution 
D* when i is fixed to the given value, Xi, . . . , are fixed to a;i, . . . , and Xi, Y are 
fixed to X, y. Hence, the average probability of error of P/.^^ under distribution D 

p' 

i;xi,...,xi_i _ p* /„x 
— ^D*;i;xi,...,Xi-i \'^) 

Let M' denote the first message of P/.^,^ and X' denote the register Xi holding the 

input X to Alice. Because of the "secureness" of P*, the density matrix of [X',M') in 
protocol P/.^^ is the same as the density matrix of (Xj,M) in protocol P* when 

Xi, . . . , Xi_i are set to Xi, . . . , Hence 

I{X' : M') = /((X, : M)|Xi, . . . , X,_i = xi, . . . , x,_i) (4) 

Using Lemma § and equations (^ and (^), we get a [t — 1, c + Zi, Z2, • • • , ^t]^ safe coinless 
quantum protocol Pi-xi,...,xi.i for / with 



^ ((21n2)/(X' : M'))'/^ 



-D 



+ ((2 In 2)/((X, : M) |Xi, . . . , X,_i = Xi, . . . , x,_i))^ 



(5) 



We now construct a \t — l,c + li,l2,--.,lt\^ safe public coin quantum protocol P for /, 
which is nothing but a probability distribution (under D*) over the safe coinless quantum 
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protocols Pi-xi,...,Xi_i, i £ N, G E. For protocol P, we get (note that the 

expectations below are under distribution D*) 







p 


-1 




< 


Ei,x 


^D*;i;xi,.. 


i^i — 1 


+ ((21n2)/((X, : M)|Xi, . . . , X,_i = Xi, . . . , 


< 


Ei^x 


- p, 

^D*;i;xi,.. 




+ ((21n2)E,,x [/((X, : M)|Xi, . . . ,X,_i = Xi, . . . 


< 


-( 

e 


'Ah ln2\ 

. ^ / 


1/4 





a/4 



The first inequality follows from (j^), the second inequality follows from the concavity of 
the fourth root function and the last inequality from from (|l]) and @). 

This completes the proof of the quantum round elimination lemma. ■ 

4.2 The classical round elimination lemma 

The proof of the classical round elimination lemma is similar to that of the quantum round 
elimination lemma. First, we have the following classical analogue of Lemma ^. 

Lemma 6 Suppose f : E x F G is a function. Let D be a probability distribution on 
E X F, and P be a [t, 0, /i, . . . , It]^ private coin classical randomised protocol for f . Let X 
stand for the classical random variable denoting Alice's input (under distribution D), M be 
the first message of Alice in the protocol P, and I{X : M) denote the mutual information 
between X and M under distribution D. Then there exists a [t — 1, 0, ■ ■ ■ ? h]^ public coin 
classical randomised protocol Q for f , such that 



=g<e£ + -((21n2)/(X:M))i/2 



A proof of the lemma is given in the appendix. 

We can now prove the classical round elimination lemma (for the communication game 

/(n)). 

Lemma 7 (Classical round elimination lemma) Suppose f : E x F ^ G is a func- 
tion. Suppose the communication game /'•"^ has a [t, 0, /i, . . . , /(]^ public coin classical 
randomised protocol with worst case error less than 5. Then there is a\t — 1, 0, /2, . . . , lt\^ 
public coin classical randomised protocol for f with worst case error less than e = 6 + 



(l/2)(2/i ln2/n 



,1/2 



Proof: (Sketch) The proof is similar to that of Lemma ^, but using Lemma ^ instead 
of Lemma H. Suppose the given protocol for /^"•' has worst case error 5 < 5. Define 



e = 5 + (l/2)(2/i ln2/n)^/^. To prove the classical round elimination lemma it suffices 
to give, by the harder direction of the minimax lemma (Lemma |ip, for any probability 
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distribution D on E x F, a [t — l,0,l2, ■ ■ ■ , k]^ public coin classical randomised protocol 
P for / with average distributional error < e < e. To this end, we construct the 
probability distribution D* on x [n] x F as before. By the easier direction of the 
minimax lemma (Lemma P, we get a [t,0,/i, . . . ,lt]^ classical deterministic protocol P* 
for /*^"^ with distributional error, e£t < 6 < 6. In P*, Ahce gets xi, . . . , a;„ G -E, Bob gets 
i E [n], y E F and a copy of a;i, . . . , We shall construct the desired protocol P from 
the protocol P*. 

Let M be the first message of Alice in P*. Let the input to Alice be denoted by 
the classical random variable X = X1X2 . . . X„ where Xi is the classical random variable 
corresponding to the ith input to Alice. Let the classical random variable Y denote the 
input y of Bob. Define e^'.j.^.^ ... x^.i be the average error of P* under distribution D* 
when i is fixed and Xi, . . . , are fixed to xi, . . . , Arguing as before, we get 

I = E,^x[I{{X, : M)|Xi, . . . , = xi, . . . , 

Also 

5 > e£* = Ei^x [(^D*;i;xi,...,x,.-, 

The expectations above are under distribution D*. 

For any i G [n], Xi, . . . ,Xi_i G E, define the [t,0,li, . . . Jt]^ private coin classical 
randomised protocol P/.^,^ for the function / as follows. Alice is given x G P and Bob 
is given y E F. Bob sets i to the given value, and both Alice and Bob set Xi, . . . ,Xi_i 
to the values Xi, . . . , Xj_i. Alice tosses her private coin to choose Xj+i, . . . , X„ G P, where 
each Xj,i + 1 < j < n is chosen independently according to the (marginal) distribution 
on P induced by D. Alice sets Xj = x and Bob sets Y = y. Then they run protocol 
P* on these inputs. The probability that P/.^^ makes an error for an input {x,y), 

1 ^ ^j^^ average probability of error of P* under distribution D* when i is fixed to 
the given value, Xi, . . . , Xj_i are fixed to Xi, . . . , Xj_i, and Xj, Y are fixed to x, y. Hence, 
the average probability of error of P/.^.^ under distribution D 

PL 



i;xi,...,Xi_-i _ p* 

^D* ■,i;xi,...,Xi—i 

Let M' denote the first message of P/.^.^ and X' denote the register Xj holding the 

input X to Alice. Then 

J(X' : M') = /((X, : M)|Xi, . . . , X,_i = xi, . . . , Xj_i) 

Using Lemma |^ and arguing as before, we can complete the proof of the classical round 
elimination lemma. ■ 



5 Applications of the round elimination lemma 

In this section, we apply our round elimination lemmas to prove lower bounds for the query 
complexity of the static predecessor problem, and rounds versus communication tradeoffs 
for the 'greater-than' problem. 
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5.1 Static predecessor problem 



The proof of our lower bound for the static predecessor problem in the address-only quan- 
tum cell probe model is similar to the classical proof in Miltersen et al. [|MNSW98|| . But 



because we use a stronger round elimination lemma, we can prove stronger lower bounds. 
We start by some preliminary observations. 

Definition 3 (Rank parity communication games, |PV1JNSW98|| ) /n t/ie rank parity 
communication game PARp g, Alice is given a hit string x of length p, Bob is given a set S 
of bit strings of length p, \S\ < q, and they have to communicate and decide whether the 
rank of x in S (treating the bit strings as integers) is odd or even. By the rank of x in S, 
we mean the cardinality of the set {y & S \ y < x}. In the game PAR(^'^, Alice IS given 
k bit strings Xi, . . . ,Xk each of length p, Bob is given a set S of bit strings of length p, 
\S\ < q, an index i G [k], and a copy of Xi, . . . they have to communicate and decide 

whether the rank of xi in S is odd or even. In the game PAR^'^^''^, Alice is given a bit string 
X of length p and an index i E [k], Bob is given k sets Si, . . . , Sk of bit strings of length p, 
\Sj\ < q; they have to communicate and decide whether the rank of x in Si is odd or even. 



Proposition 4 Let there be a (?t,*^*^^\ {\ogm)'^^^\t) address-only quantum cell probe solu- 
tion to the static predecessor problem, where the universe size is m and the subset size is at 

mostn. Then there is a \ 2t + 0(1), 0, O(logn), (logm)*^*^^M safe coinless (and hence, pub- 
lic coin) quantum protocol for the rank parity communication game PARiogm,n- The error 
probability of the communication protocol is the same as that of the cell probe scheme. 

Proof: Consider the static rank parity data structure problem where the storage scheme 
has to store a set S' C [m], l^l < n, and the query scheme, given a query x G [m], has to 



decide whether the rank of x in S* is odd or even. Fredman, Komlos and Szemeredi |[FKS84 
have shown the existence of two-level perfect hash tables containing, for each member y 
of the stored subset S, y's rank in S, and using 0{n) cells of word size O(logm) and 
requiring only 0(1) classical deterministic cell probes. Combining a {n'^^^\ {\ogm)'^^^\t) 
address-only quantum cell probe solution to the static predecessor problem with such a 
perfect hash table, gives us a {n^^^^ + 0(n), max((logm)'^*^^\ O(logm)), t -|- 0(1)) address- 
only quantum cell probe solution to the static rank parity problem. The error prob- 
ability of the cell probe scheme for the rank parity problem is the same as the error 
probability of the cell probe scheme for the predecessor problem. By Lemma H, we get 
a {2t -\- 0(1), 0, 0(log?T,), (logm)'^(^^)'^ safe coinless quantum protocol for the rank parity 
communication game PARiog m.n- The error probability of the communication protocol is 
the same as that of the cell probe scheme for the predecessor problem. ■ 



p,<i 



Proposition 5 ( |[MNSW98|| ) Suppose k divides p. A communication protocol for PAR 
with Alice starting, gives us a communication protocol for PAR^^)^"^ with Alice starting, with 
the same message complexity, number of rounds and error probability. 
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Proof: Consider the problem PARp^]^"^. Alice, who is given xi,...,Xk, computes the 
concatenation x = xi ■ X2 ■ ■ ■ Xk- Bob, who is given S, i and xi, . . . , Xi-i, computes 

S = {xi-X2---Xi^i-yOP^'-'/''^ \ yeS} 
Alice and Bob then run the protocol for PARp^ on the inputs x, S to solve the problem 

Proposition 6 ( |[MNSW98|| ) Suppose k divides q, and k is a power of 2. A commu- 
nication protocol for PARp^g with Boh starting, gives us a communication protocol for 
q/k '^ith Boh starting, with the same message complexity, numher of rounds 
and error prohahility. 

Proof: Consider the problem PARp^^j^^_^ g^^. Alice, given x and i, computes x = {i — 1) ■ 
■ X. Bob, given 5*1, ... , Sk, computes the sets S[, . . . , S'). where 

- 1) ■ ■ y \ y & Sj} if \Sj\ is even 

-l)-0-y \ y e Sj}\j{{3 - I) - P-i^s'^} if \Sj\ is odd 

Above, the integers {i — 1), {j — 1) are to be thought of as bit strings of length log A;. Bob 
also computes 5" = [jj=i Sj. Alice and Bob then run the protocol for PARp^g on inputs x, 

S to solve the problem P^R^pl{ogk-i,q/k- ■ 
We now prove the lower bound on the query complexity of static predecessor in the 
address-only quantum cell probe model. 

Theorem 1 Suppose we have a {n'^^^\ ([ogm)'^^^\t) hounded error quantum address-only 
cell prohe solution to the static predecessor prohlem, where the universe size is m and the 
suhset size is at mostn. Then the numher of queries t is at least ( log log m \ ^ function 

■' ^ \ log log log my ■' 

of m, and at least a function of n. 




Proof: We basically imitate the proof of Miltersen et al. | [M1NSW1?^ , but in our quantum 



setting. By Proposition ^, it suffices to consider communication protocols for the rank 
parity communication game PARiog^,^. Let n = 2(i°gi°g'^)Viogiogiogm_ a (41^2)12^ 

For any given constants 02,03 > 1, define 



A , , A , A loglogm 

a = 02 log n = (log m) t 



(ci + C2 + C3) log log log m 

We shall show that the rank parity communication game PARiogm,n does not have bounded 
error (2t, 0, a, b)^ safe public coin quantum protocols, thus proving the desired lower bounds 
on the query complexity of static rank parity (and hence, static predecessor) by Lemma 0. 

Given a (2^,0,0,6)"^ safe public coin quantum protocol for PARiogm.n with error prob- 
ability 6 {6 < 1/3), we get a (2t, 0, a, b)^ safe public coin quantum protocol for 

pAp(ciat*),A 
r/-\r\ logm 
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with the same error probabihty S, by Proposition ^. Using the quantum round ehmination 
lemma (Lemma we get a (2t — 1, a, a, b)^ safe public coin quantum protocol for 



PAR 



log "I „ 
C]^ at 



but the error probability increases to at most 6 + (12t) ^. Using the reduction of Proposi- 
tion H, we get a {2t — l,a, a, h)^ safe public coin quantum protocol for 



^-log(ciW4)-l,_^ 

with error probability at most 5 + (12t)^^. From the given values of the parameters, we 
see that 

> log(c,6t^) + 1 



This implies that we also have a (2t — 1, a, a, 6)'^ safe public coin quantum protocol for 

pAD(cif't''),B 



with error probability at most 5 + (12t) ^. Using the quantum round elimination lemma 
(Lemma |^) again, we get a {2t — 2, a + h, a,h)^ safe public coin quantum protocol for 

PAR log m n 



but the error probability increases to at most 5 + 2(12t)~^. 

We do the above steps repeatedly. After applying the above steps i times, we get a 
{2t — 2z, z(a + 6), a, 6)"^ safe public coin quantum protocol for 

PAR log ra n 

with error probability at most 6 + 22(12t)~^. 

By applying the above steps t times, we finally get a (0, t(a + b),a, b)^ safe public coin 
quantum protocol for 

PAR log m n 

with error probability at most 5+2t(12t)^^ < 1/2. From the given values of the parameters, 
we see that 



{2ciat^y - ^ ^ ' (cifot^V 



Thus we get a zero round protocol for a rank parity problem on a non-trivial domain with 
error probability less than 1/2, which is a contradiction. 

In the above proof, we are tacitly ignoring "rounding off" problems. We remark that 
this does not affect the correctness of the proof. ■ 
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5.2 The 'greater- than' problem 

Theorem 2 The t round hounded error quantum (classical randomised) communication 
complexity of GT^ is n{n^/H-^) (n{n^'H~'^)). 



Proof: We recall the following reduction from GT^l to GT„ (see ||MNSW98|| ): In GT^ ^ 



Alice is given xi,...,Xk G {0,1}""/*^, Bob is given i G [A;], y E {0,1}"/^, and copies of 
Xi, . . . , Xj-i, and they have to communicate and decide if Xi > y. To reduce GTj^'jl to GT„, 
Alice constructs x G {0, 1}" by concatenating Xi, . . . ,Xk, Bob constructs y G {0, 1}" by 
concatenating xi, . . . , it is easy to see that x > y iS Xi > y. 

Suppose GTn has a [t,0,li, . . . Jt]"^ safe public coin quantum protocol with worst case 
error probability less than 1/3. Suppose 

n > (Ct^h + ■■■ + /; 
where C = (4 In 2)6^. For I <i <t, define 

A ^,4, A n 




Also define uq = n and eq = 1/3. Then 




1 t 



and 



1/2 
3 Qt ' 



n n nt* 



We now apply the above self-reduction and the quantum round elimination lemma 
(Lemma ^ alternately. Before the zth stage, we have a [t — i + 1, S}=i ^j: h, ■ ■ ■ , hY safe 
public coin quantum protocol for GTni_^ with worst case error probability less than ej_i. 
Here Z = A ii i is odd, Z = B otherwise. For the ith stage, we apply the self-reduction 
with k = ki. This gives us a [t — i + 1, Z]}=i ijji, ■ ■ ■ Jt]^ safe public coin quantum protocol 
for GT^'^') with the same error probability. We now apply the quantum round elimination 
lemma (Lemma |^) to get a [t — i, Yl)=i Iji h+i, ■ ■ ■ Jt]^' safe public coin quantum protocol 
for GT„,- with worst case error probability less than e,. Here Z' = B if Z = A and Z' = A 
if Z = B. This completes the ith stage. 

Applying the self-reduction and the round elimination lemma alternately t times gives 
us a zero round quantum protocol for the 'greater-than' problem on a domain of size rit > 1 
with worst case error probability less than = 1/2, which is a contradiction. 

In the above proof, we are tacitly ignoring "rounding off" problems. We remark that 
this does not affect the correctness of the proof. 

This proves the quantum lower bound of fi(n^/*t~^) on the message complexity. 
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Using the classical round elimination lemma (Lemma |^ instead of the quantum one, 
and treating a classical randomised protocol with complexity / as a [t, 0, /, . . . , l]^ protocol, 
we get the stronger classical lower bound of f2(n^/*t~^). ■ 

Miltersen et al. ||MNSW98[| also apply their round elimination lemma to prove (classical) 
lower bounds for other data structure problems and communication complexity problems. 
We remark that we can extend all those results in a similar fashion to the quantum world. 



6 Lower bounds for static membership 

Consider the problem of storing a subset 5* of size at most n of the universe [m] in a table 
with q cells, so that membership queries can be answered efficiently. We restrict the storage 
scheme to be implicit, using at most p 'pointer values'. A 'pointer value' is a member of 
a set of size p (the set of 'pointers') disjoint from the universe. The term implicit means 
that the storage scheme can store either a 'pointer value' or a member of in a cell. In 
particular, the storage scheme is not allowed to store an element of the universe which 
is not a member of S. The query algorithm answers membership queries by performing 
t (general) quantum cell probes. We call such schemes (p, g, t) implicit storage quantum 
cell probe schemes. For universe sizes m that are 'large' compared to n,p, q, we can prove 
an Q{logn) lower bound on the number of quantum probes t required to solve the static 
membership problem with {p, q, t) implicit storage quantum cell probe schemes. We start 
with the following lemma. 

Lemma 8 Suppose S is ann element subset of the universe [m], where m > 2n + 2. If the 
storage scheme is implicit, always stores the same 'pointer' values in the same locations, 
and in the remaining locations, stores the elements of S in a fixed order ( repetitions of an 
element are allowed, but all elements have to be stored) based on their relative ranking in 
S, then fi(logn) probes are needed by any bounded error quantum cell query strategy to 
answer membership queries. 

Proof: (Sketch) The proof follows by modifying Ambainis's lower bound proof for quan- 
tum ordered searching |[Amb99| ] . There, it was shown that if S is stored in sorted order in 



a table T then, given any query element g, Vtilogn) probes are required by any quantum 
search strategy to find out the smallest index i, 1 < i < n, such that q < T{i). We observe 
that the lemma above does not follow directly from the result of Ambainis, since we only 
need to decide if q is present in the table or not, and this is a weaker requirement. To 
prove the lemma, we follow the adversary strategy of [|Amb99|| with some minor changes. 



We study the behaviour of the quantum query scheme with query element n + 1. The 
proof of Ambainis is based on a clever strategy of subdividing "intervals" (an interval is a 
contiguous set of locations in the sorted table). We work instead with "logical intervals", 
where a logical interval denotes the set of locations in the table where elements contigu- 
ous in the natural ordering are stored (as determined by the fixed storing order). After 
this definition, one can easily show that the same subdivision strategy as in | ]Amb99[ | goes 
through. In Ambainis's proof, the adversary constructs inputs by padding with zeros from 
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the beginning up to the left of an interval, and with ones from the end up to the right of the 
interval. Instead, we pad with small numbers (1,2, . . .) from the logical beginning up to 
the logical left of a logical interval, and with large numbers (m, m — 1, . . .) from the logical 
end up to the logical right of the logical interval. We store the appropriate 'pointer values' 
in the 'pointer locations' (predetermined by the storing strategy). After doing this, one 
can easily show that the same error analysis of ||Amb99|| goes through. Thus, the adversary 



finally can produce two inputs, one of them containing n + 1 and the other not, such that 
the behaviour of the query scheme is very similar on both. This is a contradiction. ■ 

Remark: H0yer et al. also prove an f2(logr;,) lower bound for quantum ordered search- 
ing [[H1\IS01| . But their approach, which is based on "distinguishing oracles", does not 



seem to be suitable for proving lower bounds for boolean valued functions. Hence to prove 
Lemma H, we modify the older Q{\ogn) lower bound of Ambainis for quantum ordered 
searching. 

Theorem 3 For every n,p,q, there exists an N{n,p,q) such that for all m > N{n,p,q), 
the following holds: Consider any bounded error {p, q, t) implicit storage quantum cell probe 
scheme for the static membership problem with universe size m and size of the stored subset 
at most n. Then the quantum query scheme must make t = fi(logn) probes. 



Proof: (Sketch) Our proof follows from the Ramsey theoretic arguments of Yao [|Yao81 
together with Lemma |. The details are omitted. 



7 Conclusions and open problems 

In this paper we introduce the quantum cell probe model, a model for studying static data 
structure problems in the quantum world. We show that the additional power of quantum 
querying does not help for the static membership problem when the storage scheme is 
restricted to be implicit, generalising a result of Yao. We also explore the possibility of 
using quantum communication complexity to prove lower bounds in the quantum cell probe 
model. We prove a round elimination lemma for quantum communication complexity and 
use it to prove lower bounds for the static predecessor problem in a restricted version of the 
quantum cell probe model, the address-only version. Extending this result to the general 
model remains an important open problem. We also use the quantum round elimination 
lemma to prove rounds versus communication tradeoffs for the 'greater-than' problem. It 
would be interesting to find other applications of the round elimination lemma to quantum 
communication complexity. 
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Appendix 

A Proof of Lemma |6| 

In this section, we prove Lemma The proof is somewhat similar to the proof of Lemma 4.4 



in Klauck et al. [|KNTZ01|| , but much simpler since we are in the classical setting. We first 
state a theorem which will be required in the proof of Lemma The quantum version 
of this theorem, called the "average encoding theorem", has been proved by Klauck et 



al. ||KNTZ01| , who also use it in the proof of Lemma 4.4 in their paper. Intuitively speaking, 
the theorem says that if the mutual information between a (classical) random variable 
and its (classical) encoding is small, then the various probability distributions on the 
codewords are close to the average probability distribution on the codewords. Below, the 
notation \\a — p\\i stands for the total variation distance {ii distance) between probability 
distributions a and p over the same sample space. 



Theorem 4 (Average encoding, classical version, [ |KJNTZ(JT[ |) Let X be a classical 



random variable, which takes value x with probability p^, and M be a classical randomised 
encoding x ^ ax of X , where ax is a probability distribution over the sample space of 
codewords. The probability distribution of the average encoding is a = J^xPxO'x- Then 



J2P'AW--^h < V(21n2)/(X:M) 

X 

We now proceed to the proof of Lemma |^. 

Lemma ^ Suppose f : E x F G is a function. Let D be a probability distribution on 
E X F, and P be a [t, 0,li, . . . , It]^ private coin classical randomised protocol for f. Let X 
stand for the classical random variable denoting Alice's input (under distribution D), M be 
the first message of Alice in the protocol P, and I{X : M) denote the mutual information 
between X and M under distribution D. Then there exists a [t — l,0,l2,---, k]^ public coin 
classical randomised protocol Q for f , such that 

eg<e£ + ^((21n2)/(X:M))i/2 



Proof: We first give an overview of the plan of the proof, before getting down to the 
details. The proof proceeds in stages. 
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Stage 1: Starting from P, we construct a [t,li, . . . ,lt]"^ private coin protocol P', where 
the first message is independent of Ahce's input, and eg' < eg + (l/2)((2 In2)/(X : M)y/^. 
The important idea in this step is to first generate Ahce's message using a new private 
coin without "looking" at her input, and after that, to adjust Alice's old private coin in a 
suitable manner so as to be consistent with her message and input. 

Stage 2: Suppose the coin tosses in P' were done in public. Then Bob can generate the 
first message of P' himself, as it is independent of Alice's input. Doing this gives us a 
[t — l,l2, ■ ■ ■ , h]^ public coin protocol Q, such that e^^ = e^y for every (x, y) E E x F. 

The protocol Q of Stage 2 is our desired [t—1, 12, ■ ■ ■ , k]^ public coin classical randomised 
protocol for /. We have 

eg = e£'<eg + ^((21n2)/(X:M))i/2 

We now give the details of the proof. Let ax be the probability distribution of the first 
message M of protocol P when Alice's input X = x. Let Y denote Bob's input register. 
Define a = J2xPxO'x, where px is the (marginal) probability of x under distribution D. 
a is the probability distribution of the average first message under distribution D. By 
Theorem |^, we get that 

E^-lk- - ^lli < V'(21n2)/(X:M) 

X 

For X E E and an instance m of the first message of Alice, let g^"* denote the (condi- 
tional) probability that the private coin toss of Alice results in r, given that Alice's input 
is X and her first message in protocol P is m. Let a{m \ x) denote the probability that the 
first message of Alice in P is m, given that her input is x. Let a{m) denote the probability 
of m occurring in the average first message of Alice. Then, cr(m) = J2xPxO'{fn \ x). 

Stage 1: We construct a [t, 0, /i, . . . , /j]^ private coin classical randomised protocol P' 
for / with average error under distribution D, eg' < eg + (l/2)((2 In2)/(X : M))i/^ and 
where the probability distribution of the first message is independent of the input to Alice. 
Suppose Alice is given x E E and Bob is given y E F. Alice tosses a fresh private coin 
to pick m with probability a{m). She then sets her old private coin to r with probability 
q^^. (If in P, message m cannot occur when Alice's input is x, we say that protocol P' 
gives an error if such a thing happens.) After this, Alice and Bob behave as in protocol P 
(henceforth, Alice ignores the new private coin which she had tossed to generate her first 
message m). Hence in P', the probability distribution of the first message is independent 
of Alice's input. 

Let us now compare the situations in protocols P and P' when Alice's input is x, Bob's 
input is y, Alice has finished tossing her private coins, but no communication has taken 
place as yet. In protocol P, the probability that Alice's private coin toss results in r is 

Y,a{m\x)qr 
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In protocol P', the probability that Alice's (old) private coin toss results in r is 

m 

Thus, the ii distance between the probability distributions on Alice's (old) private coin 
toss is 



E 



^g^"(cr(m I x) - aim)) 



< ^^g^" |(j(m I x) - (T(m) 

r m 

= ^ |a(m|x)-a(m)|^g: 

m \ 

= ^ \a{m I x) — cr(m)| 

m 

= \Wx-(^\\l 

Hence, the error probability of P' on input x, y 



xm 
r 



< (^x,y + 2\\^x - 



Let qxy be the probability that {X,Y) = {x,y) under distribution D. Then, the average 
error of P' under distribution D, , is bounded by 



~D 



EP' 
^xy^x,y 



x,y 



x,y 



'x,y 



IC-r — (J] 



'D 



< e£ + l((21n2)J(X:M))V2 

The last inequality follows from the "average encoding theorem" (Theorem 

Stage 2: We now construct our desired [t — l,0,l2, ■ ■ ■ ,k]^ public coin classical ran- 
domised protocol Q for / with = e^'. Suppose all the coin tosses of Alice and Bob in 
P' were done publicly before any communication takes place. Now there is no need for the 
first message from Alice to Bob, because Bob can reconstruct the message by looking at 
the public coin tosses. This gives us the protocol Q, and trivially 



eg = 6E'<e£ + -((21n2)/(X:M))V2 



This completes the proof of Lemma 0. 
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B Proof of Lemma g 



In this section, we prove Lemma We first start with the definition of the trace norm of 
hnear operators, then state three theorems which will be required in the proof of Lemma ^, 
and after that, we finally present the proof of Lemma ^. 

For a linear operator A on a finite dimensional Hilbert space, the trace norm of A is 
defined as \\A\\t = Tr V A^A. The following fundamental theorem (see ||AKM98[ ) shows 



that the trace distance between two density matrices pi, P2, \\pi — P2\\t, bounds how well 
one can distinguish between pi,p2 by a measurement. 

Theorem 5 ( |[AKJN9"8| ) Let pi, p2 be two density matrices on the same Hilbert space. Let 
M. be a general measurement (i.e. a POVM), and Aipi denote the probability distributions 
on the (classical) outcomes of Ai got by performing measurement M. on pi. Let the ii 
distance between M.pi and M.p2 be denoted by \\J^pi — M.p2\\i- Then 

\\Mpi - Mp2\\l < \\pl - p2\\t 

In the proof of Lemma ^, we will need the following "average encoding theorem" of 
Klauck et al. [ |KNTZ01| . Intuitively speaking, it says that if the mutual information be- 



tween a classical random variable and its quantum encoding is small, then the various 
quantum "codewords" are close to the "average codeword" . 



Theorem 6 (Average encoding, quantum version, ||KNTZ01[1 ) Suppose X, Q are 



two disjoint quantum systems, where X is a classical random variable, which takes value 
X with probability p^, and Q is a quantum encoding x ^ of X. Let the density matrix 
of the average encoding be a = J2x Px<^x ■ Then 



^Px\Wx-cj\\t<^Ji2\n2)I{X:Q) 



We will also need the following "local transition theorem" of Klauck et al. [KNTZOl 



Theorem 7 (Local transition, [[KNTZ01|] ) Let pi,p2 be two mixed states with support 



in a Hilbert space Ti, K, any Hilbert space of dimension at least the dimension of Ti, and 
\(f)i) any purifications of pi inTi® IC. Then, there is a local unitary transformation U on 

K, that maps |(^2) to 102) = (/ Cg) U)\(j)2) (I is the identity operator onTi) such that 



Il0l)(0l| - I02)(02ll|t < Sy'llpi - P2\\t 



We now proceed to the proof of Lemma ^. The proof is similar to the proof of Lemma 4.4 
in [ [KJNTZ01| , but with a careful accounting of "safe" overheads in the messages communi- 
cated by Alice and Bob. 

Lemma ^ Suppose f : E x F G is a function. Let D be a probability distribution on 
E X F, and P be a [t,c,li, . . . , Z^]^ safe coinless quantum protocol for f . Let X stand for 
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the classical random variable denoting Alice's input (under distribution D), M be the first 
message of Alice in the protocol P, and I{X : M) denote the mutual information between 
X and M under distribution D. Then there exists a \t — 1, c + Zi, • • • , ^i]^ safe coinless 
quantum protocol Q for f , such that 

eg<e£ + ((21n2)/(X:M))i/^ 

Proof: We first give an overview of the plan of the proof, before getting down to the 
details. The proof proceeds in stages. We remark on the similarities between the stages 
in the quantum proof, and the stages in the classical proof (Lemma Stages lA and IB 
of the quantum proof together correspond to Stage 1 of the classical proof, and Stages 2A 
and 2B of the quantum proof together correspond to Stage 2 of the classical proof. 

Stage lA: Starting from the [t, c, /i, . . . , /j]"^ safe coinless protocol P, we construct a 
[t, c, /i, . . . , /f]^ safe coinless protocol P with e^y = e^y for every {x,y) E E x F. P 
contains an extra "secure" copy of Alice's input x G -E, but is otherwise the same as P. 

Stage IB: Starting from P, we construct a [t,c,li, . . . Jt]"^ safe coinless protocol P', 
where the first message is independent of Alice's input, and e£' < e^ + ((21n2)J(X : M))^/^. 
The important idea in this step is to first generate Alice's average message (which is 
independent of her input), and after that, use the extra "secure" copy of Ahce's input x 
to apply a unitary transformation Ux on some of her qubits without touching her message. 
t4 is used to adjust Ahce's state in a suitable manner so as to be consistent with her input 
and message. This "adjustment" step requires the use of the "local transition theorem" 
(Theorem |^. 

Stage 2A: Since in P' the first message is independent of Alice's input. Bob can generate 
it himself. But it is also necessary to achieve the correct entanglement between Alice's 
qubits and the first message. Bob does this by first sending a safe message of /i + c qubits. 
Alice then applies a unitary transformation on some of her qubits, using the extra 
"secure" copy of her input x, to achieve the correct entanglement. The existence of such 
a Vx follows from Theorem |^. Doing all this gives us a [t + 1, c + Zi, 0, 0, ^2, • • • , k]^ safe 
coinless protocol Q', such that e^y = ef ^ for every {x, y) E E x F. 

Stage 2B: Since the first message of Alice in Q' is zero qubits long. Bob can concatenate 
his first two messages, giving us a [t — 1, c + /i, ^2, • • • , k]^ safe coinless protocol Q, such 
that e^y = e^y for every (x, y) E E x F. The technical reason behind this is that unitary 
transformations on disjoint sets of qubits commute. 

The protocol Q of Stage 2B is our desired [t — l,c + li,l2,---,k]^ safe coinless quantum 
protocol for /. We have 

eg = eg' = e£' < eg + ((21n2)/(X : M))'/^ = e£ + ((21n2)/(X : M))'/^ 
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We now give the details of the proof. Let ax be the density matrix of the first message 
M of protocol P when Alice's input X = x. Let Y denote Bob's input register. Define 
(J = Y^xPxCx, where Px is the (marginal) probability of x under distribution D. a is the 
density matrix of the average first message under distribution D. By the "secureness" of 
P, a is also the density matrix of the first message when is fed to Alice's input register 
X, where = ^/Px\x). By Theorem we get that 

Y.P-h- - ^Wt < V(21n2)/(X:M) 

X 

Stage lA: We first construct a [t, cji, . . . , It]"^ safe coinless quantum protocol P for / 
such that e^y = e^y, for every {x,y) E E x F. Let X be Alice's input register in P. In P, 
Alice has an additional register C, and the input x to Alice is fed to register C, instead of 
X. X is initialised to |0) in P. In protocol P, Alice first copies the contents of C to X. 
After that, things in P proceed as in P. Register C is not touched henceforth, and thus, 
C holds an extra "secure" copy of x throughout the run of protocol P. 

Stage IB: We now construct a [t, c, /i, . . . , k]"^ safe coinless quantum protocol P' for / 
with average error under distribution D, eg' < eg + ((21n2)J(X : M))^/^, and where the 
density matrix of the first message is independent of the input x to Alice. Alice is given 
X & E and Bob is given y E F. Consider the situation in P after the first message has 
been prepared by Alice, but before it is sent to Bob. Let register A denote Alice's qubits 
excluding the message qubits M and the qubits of the "secure" copy C (in particular, A 
includes the qubits of register X). Without loss of generality, one can assume that register 
A has at least h + c qubits, because one can initially pad up A with ancilla qubits set to 
|0). Let \x)c® \Ox)am be the state vector of CAM in P at this point, where the subscripts 
denote the registers. \9x)am is a purification of ax- We note that 16*2;) is also the state vector 
of AM in protocol P at this point. P' is similar to P except for the following. Alice puts 
Itp) in register X (instead of copying C to X as in P) to create the first message in register 
M with density matrix cr. AM now contains a purification \6) of a. Then Alice applies a 
unitary transformation Ux depending upon x (which is available "securely" in register C) 

on A, so that \6'^)am = {Ux ® I)\0)am is "close" to \6x)am- Here I stands for the identity 
transformation on M. Theorem tells us that there exists a unitary transformation Ux on 
A such that 

lll^x)(^.|-|C)(Clllt< 2^1^.-^11* 

Thus, \x)c ® \d'x)AM is the state vector of CAM in P' after the application of Ux- Alice 
then sends register M to Bob and after this, Alice and Bob behave as in P. Application 
of Ux does not affect the density matrix of register M, which continues to be a. Hence in 
P', the density matrix of the first message is independent of Alice's input. 

Let us now compare the situations in protocols P and P' when Alice's input is x, Bob's 
input is y, Alice has prepared her first message, but no communication has taken place 
as yet. At this point, in both protocols P and P', the state vector of Bob's qubits is the 
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same, and in tensor with the state vector of Ahce's qubits. Let B denote the register of 
Bob's qubits (including his input qubits Y) and let \ri)B denote the state vector of B at 
this point. Hence the global state of protocol P at this point is \x)c ® \Ox)am ® \v)b, and 
the global state of P' is \x)c ® \0'^)am ® \v)b- Therefore, the global states of protocols P 
and P' at this point differ in trace distance by the quantity 

\\\x){x\®%){e^,\m{v\-\x){x\®\e'j{e'j®\v){v^^^^ 

Using Theorem |^, we see that the error probability of P' on input x, y 

C < iy + l\\\x){x\ ® \0x){O.\ ® \V){V\ - \x){x\ ® ® \v){v\\\t < e^y + ^h,-a\\t 

Let qxy be the probability that {X,Y) = {x,y) under distribution D. Then, the average 
error of P' under distribution D, , is bounded by 

— 
< 



< 



< 

For the second inequality above, we use the concavity of the square root function. The 
last inequality follows from the "average encoding theorem" (Theorem 

Stage 2A: We now construct a [t+ 1, c+li, 0, 0, /2, • • • , k]^ safe coinless quantum protocol 
Q' for / with e'^y = e^y, for all {x,y) E E x F. Alice is given x E E and Bob is given 
y E F. The protocol Q' will be constructed from P' . The input x is fed to register C of 
Alice, and the input y is fed to register Y of Bob. Let register G denote all the qubits 
of register A, except the last li + c qubits. In protocol Q' the registers initially in Alice's 
possession are C and G, and the registers initially in Bob's possession are B, M, and a 
new register R, where R is li + c qubits long. The qubits of G are initially set to |0). 
Bob first prepares the state vector \ri) in register B as in protocol P'. He then constructs 
a canonical purification of a in registers MR. The density matrix of M is a. Bob then 
sends R to Alice. The density matrix of R is independent of the inputs x^y (in fact, if 
the canonical purification in MR is the Schmidt purification, then the density matrix of 
R is also 0"). After receiving i?, Alice treats GR as the register A in the remainder of the 
protocol. AM now contains a purification of a. Alice applies a unitary transformation 
Vx depending upon x (which is available "securely" in register G) on A, so that the state 
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vector of AM becomes \6'^)am- The existence of such a Vx follows from Theorem 0. At 
this point, the global state vector (over all the qubits of Alice and Bob) in Q' is the same 
as the global state vector in P' viz. \x)c ® IOam ® \v)b- Bob now treats register M as if 
it were the first message of Alice in P', and proceeds to compute his response N of length 
l2- Bob sends N to Alice and after this protocol Q' proceeds as in P'. In Q' Bob starts the 
communication, the communication goes on for t + 1 rounds, the first message of Bob of 
length li + c (i.e. register R) is a safe message, and the first message of Alice is zero qubits 
long. 

Stage 2B: We finally construct a [t — l,c + li,l2, ■ ■ ■ Jt]^ safe coinless quantum protocol 
Q for / with e^y = e^y, for all {x,y) E E x F. In protocol Q, Bob (after doing the same 
computations as in Q') first sends as a single message register RN of length (/i + c) + ^2, and 
after that Alice applies Vx on A followed by her appropriate unitary transformation on AN 
(the unitary transformation of Alice in Q' on her qubits AN after she has received the first 
two messages of Bob). At this point, the global state vector (over all the qubits of Alice 
and Bob) in Q is the same as the global state vector in Q', since unitary transformations 
on disjoint sets of qubits commute. After this, things in Q proceed as in Q' . In protocol Q 
Bob starts the communication, the communication goes on for t — 1 rounds, and the first 
message of Bob of length {li + c) + I2 contains a safe overhead (the register R) of /i + c 
qubits. 

This completes the proof of Lemma ^. ■ 
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